The new test, which now passes against windows for new GPOs (but not the default ones, unfortunately) is in master and in the mega-patch for 4.0 in bug #9406.
In particular, we simply do not set and avoid comparing the SACL, the rest of the conversion seems to be OK.